Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

playfair039_320's avatar
playfair039_320
Icon for Nimbostratus rankNimbostratus
May 15, 2017

URL masking

is there actually definitive code for masking urls? I want users to be able to go to https://www.test.com and whatever happens behind the scenes, the url stays there - for security. What actually hap...
irules
LTM
security
stan_piron's avatar
stan_piron
Icon for Cumulonimbus rankCumulonimbus
May 17, 2017

Hi,

 

there is no solution in the reverse proxy to hide the real URL in a browser.

 

For security reason, the browser display the real URL and don't let server display another URL than the real one (if you go to server http://www.iwillhackyou.com and it display http://company.com, it is not safe)

 

One solution is to include your web site in a frame... you can try this irule (not tested)

 

when RULE_INIT {
     Define the main page when the user browse the URI "/"
    set static::main_uri "/logon.php"
    this is the web page to create the frame and call the URI above
    set static::frame_reponse_page {
            Title of your webpage
            
             
             
             <body>

             Your browser does not support frames

             </body>
             
            
            
  }
}

when HTTP_REQUEST {
    if {[HTTP::path] equals "/"} {     
        HTTP::respond 200 content [subst -nobackslashes $static::frame_reponse_page] noserver
    }
}

the static::main_uri variable must be set with the URL of the default URL of the website (must not be not /)

 

the main browser page will stay / and the user will browse website inside the frame...

 

Note: The code is updated to correct quote issue (not tested)